misp.conf

input {
    http_poller {
        urls => {
            misp => {
                method => get
                url => "https://misp-instance-url/events/restSearch"
                headers => {
                    "Authorization" => "YOUR_MISP_API_KEY"
                    "Accept" => "application/json"
                    "Content-Type" => "application/json"
                }
                body => '{ "returnFormat": "json", "last": "1d" }'
            }
        }
        request_timeout => 60
        schedule => { every => "1h" }
        codec => "json"
    }
}

filter {
    # You can add filters here if needed, e.g., to extract fields
}

output {
    elasticsearch {
        hosts => ["http://elasticsearch-host:9200"]
        index => "misp-events-%{+YYYY.MM.dd}"
        user => "elastic" # optional, if you have set up authentication in your Elasticsearch
        password => "yourpassword" # optional
    }
}